Re: [musl] Restrictions on child context after multithreaded fork

[Rich Felker <dalias@libc.org>]

On Sun, Aug 16, 2020 at 07:11:37PM +0200, Florian Weimer wrote:
> * Rich Felker:
> 
> > On Sun, Aug 16, 2020 at 11:10:37AM +0200, Florian Weimer wrote:
> >> * Rich Felker:
> >> 
> >> > On some inspection, glibc does not actually attempt to make the child
> >> > environment unrestricted. The only things it does around fork are:
> >> 
> >> I think pthread_once initializers that have partially executed are
> >> also executed from the start in the child if initialization is
> >> requested again.
> >
> > I don't follow how pthread_once is related. The vast majority of the
> > things I found glibc doing no specific handling for are actual mutable
> > state not just on-demand initialization.
> 
> If a fork happens during a pthread_once initialization, the subsystem
> related to that becomes unavailable after fork.  The pthread_once_t
> reinitialization logic intends to avoid that.  Like resetting locks
> after fork in the new process, it is rather questionable.

Yes but initialization is hardly the interesting case. All of the
subsystems I highlighted were not initialization but mutable state:

- adding (or removing, if you have dlclose remove them like glibc
  does) exit handlers.

- loading (or unloading) shared libraries

- adding textdomains to gettext or changing the active default one

- opening named semaphores (has a lock because POSIX requires opening
  the same one more than once to return the same sem_t pointer rather
  than a second mapping of it).

- using syslog (there's at least some state with regard to the log fd
  and log levels)

- using any time functions that depend on the timezone

The pthread_once-like initializations are another set of potential
deadlocks on top of that.

Most of the above happen fairly infrequently, especially compared to
malloc, so they're less likely to be bit, but they are deadlock
hazards that prevent the child environment from being unrestricted.
syslog and time are probably the most likely to be hit.

Rich